unbeatencoder / hflow Goto Github PK

-----
Hflow2 

What is this?
This is the next genertion for hflow, there where several objectives behind it:
-- Higher troughput
-- Better directionality detectio
-- Lower runtime dependenciers
-- Lower latency with DB


To achieve this a modular architecture was designed. 
The architecture can be tought as a packet processing language and can be used
without hflow, in fact it hflow2 became a subproject of the packet language.


How we do this?


What do I need?



-----------
FAQ



--I see a patch file.. what is this?
In order to use snort, snort must be compuliled with a special patch
to apply go to the snort directory and:

>>patch -p0 < spo_unified.c.patch

------

Small FAQ

-What is this?
yet another flow tool, but with three objectives in mind:
simplicity, modularity and a new definition of flow

-New definition of netflow, please stop waisting my time?
Not really the definition of netwflow used in this tool
includes not only the true 'in band' packets of a bidirectional
flow, but also those icmp messages that are generated by the end host.
icmp messages that are related to a flow but are generated by intermediate routers
affect the icmp packet count of the flow, but also create a new flow.
The approach is to try to capture the causality of the flows, but also to
convey as much information as possible.

-Ok why not use argus then?
There are two probles with argus:
a. The code complexity is enormous, as it tries to capture a great deal of information.
 what I try to do is similar but I am only dealing with ipv4 flows and i dont care
 much about performance metrics. (still they can be calculated).
 Just to make a quick comparison this program has (including client side) 2189 lines of code
 argus has:25014 lines of code (just argus and common code '.c' files,argus 3.0.0rc17). 
b. due to the code complexity I have found errors on both argus 2.x and 3.x
 2.x (problems with bad direction (try a  tcp syn/ack scan))
 3.x (problems with traceroute with icmp (tested on 3.0.0.rc14)


is this done yet?
no, much more is needed for this to be done, but we are getting closer!




This an early version of the pcap language stuff

a simple block of the form:


-------       --------------     ----------
|Input| ----> | Flow_Maker | --> |pcap out|
-------       --------------     ----------
                    |
                    V
            ------------------------
            |Flow Database inserter|
            ------------------------
                    |
                    V
               ----------
               | Mysqld |
               ----------